Suse Opensuse Tumbleweed vulnerabilities

CVE-2025-62875 [MEDIUM] CWE-754 CVE-2025-62875: An Improper Check for Unusual or Exceptional Conditions vulnerability in OpenSMTPD allows local user An Improper Check for Unusual or Exceptional Conditions vulnerability in OpenSMTPD allows local users to crash OpenSMTPD. This issue affects openSUSE Tumbleweed: from ? before 7.8.0p0-1.1.

CVE-2025-53882 [MEDIUM] CWE-807 CVE-2025-53882: A Reliance on Untrusted Inputs in a Security Decision vulnerability in the logrotate configuration f A Reliance on Untrusted Inputs in a Security Decision vulnerability in the logrotate configuration for openSUSE mailman3 package allows the mailman user to sent SIGHUP to arbitrary processes. This issue affects openSUSE Tumbleweed: from ? before 3.3.10-2.1.

CVE-2025-23394 [CRITICAL] CWE-61 CVE-2025-23394: A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows esc A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumbleweed cyrus-imapd before 3.8.4-2.1.

CVE-2025-23386 [HIGH] CWE-276 CVE-2025-23386: A Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed package gerbera allows the A Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed package gerbera allows the service user gerbera to escalate to root.,This issue affects gerbera on openSUSE Tumbleweed before 2.5.0-1.1.

CVE-2024-49504 [HIGH] CWE-276 CVE-2024-49504: grub2 allowed attackers with access to the grub shell to access files on the encrypted disks. grub2 allowed attackers with access to the grub shell to access files on the encrypted disks.

CVE-2023-32190 [HIGH] CWE-125 CVE-2023-32190: mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable by abusing mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable by abusing insecure file operations that run with root privileges.

CVE-2024-22029 [HIGH] CWE-732 CVE-2024-22029: Insecure permissions in the packaging of tomcat allow local users that win a race during package ins Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root

CVE-2024-22033 [MEDIUM] CWE-78 CVE-2024-22033: The OBS service obs-service-download_url was vulnerable to a command injection vulnerability. The at The OBS service obs-service-download_url was vulnerable to a command injection vulnerability. The attacker could provide a configuration to the service that allowed to execute command in later steps

CVE-2024-22034 [MEDIUM] CVE-2024-22034: Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This a Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim